[json] detect overflow sooner when serializing large sparse array.

src/json-stringifier.cc

Index: src/json-stringifier.cc
diff --git a/src/json-stringifier.cc b/src/json-stringifier.cc
index 51899a9c8bc765a4a7587416a4643ac19af0edab..10f157333c62aa254c0dac6c57b0951283cd7aad 100644
--- a/src/json-stringifier.cc
+++ b/src/json-stringifier.cc
@@ -476,6 +476,12 @@ JsonStringifier::Result JsonStringifier::SerializeJSArray(
 
 JsonStringifier::Result JsonStringifier::SerializeArrayLikeSlow(
     Handle<JSReceiver> object, uint32_t start, uint32_t length) {
+  // We need to write out at least two characters per array element.
+  static const int kMaxSerializableArrayLength = String::kMaxLength / 2;
+  if (length > kMaxSerializableArrayLength) {
+    isolate_->Throw(*isolate_->factory()->NewInvalidStringLengthError());
+    return EXCEPTION;
+  }
   for (uint32_t i = start; i < length; i++) {
     Separator(i == 0);
     Handle<Object> element;
@@ -485,6 +491,8 @@ JsonStringifier::Result JsonStringifier::SerializeArrayLikeSlow(
     Result result = SerializeElement(isolate_, element, i);
     if (result == SUCCESS) continue;
     if (result == UNCHANGED) {
+      // Detect overflow sooner for large sparse arrays.
+      if (builder_.HasOverflowed()) return EXCEPTION;
       builder_.AppendCString("null");
     } else {
       return result;